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ISS GN&C - First Year Surprises 


Abstract 

Assembly of the International Space Station (ISS) began in late 1998 with the joining of the first two US and 
Russian elements. For more than two years, the outpost was served by two Russian Guidance, Navigation, and 
Control (GN&C) systems. The station requires orbital translation and attitude control functions for its 100+ 
configurations, from the nascent two-module station to the half million kilogram completed station owned and 
operated by seventeen nations. With the launch of the US Laboratory module in February 2001, the integration of 
the US GN&C system with its Russian counterpart laid the foundation for such a robust system. 

In its first year of combined operation, the ISS GN&C system has performed admirably, even better than many 
expected, but there have been surprises. Loss of command capability, loss of communication between segments, a 
control system force-fight, and "non-propulsive vents" that weren't - such events have repeatedly underscored the 
importance of thorough program integration, testing, and operation, both across subsystem boundaries and across 
international borders. 

ISS Today 

The ISS program is a world partnership with contributions from 17 member nations. Currently measuring more than 
50m by 70m, with a mass of 135,000 kg, it is already the largest space structure ever built. Upon completion, the 
crew complement will be expanded from the current three to seven, utilizing five dedicated pressurized laboratory 
modules. The planned lifetime of ISS is 15 years, although this may be extended. The integrated GN&C system 
architecture has been designed to provide robust control capability for over 100 configurations during the build 
phase, including tolerance of a broad range of flexible bending modes of the changing station structure, visiting 
vehicles, active robotic elements, and diverse flight attitudes. 

GN&C System Overview 

The integrated ISS GN&C system is composed of two distinct GN&C systems, one in the Russian Segment (RS) 
and the other in the US segment. In addition, the GN&C system of visiting Progress cargo spacecraft are slaved to 
the RS GN&C system when docked to the ISS. The ISS GN&C functions can also be augmented by the GN&C 
systems of visiting Space Shuttle Orbiters, and in cases of extreme need, by that of Soyuz crew transfer vehicles 
which serve as the station crew’s lifeboat. In the future, the European Autonomous Transfer Vehicle (ATV) GN&C 
system will also be integrated with the RS system in the same manner as the Progress vehicle is today. 

Figure 1 shows the top level architecture of the Integrated ISS GN&C system. Alone, both the US and RS GN&C 
systems have redundancy of sensors and effectors. Together, that redundancy is several layers deep. 
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Figure 1. ISS GN&C System Architecture, Stage 8A, April 2002. 


The RS GN&C system provides the navigation functions of state, attitude, and time determination, and pointing 
support for antennae and solar arrays. It also provides the control functions of translation (orbit correction and 
debris avoidance) and propulsive attitude control. The US GN&C system provides the same navigation functions, 
as well as on-board mass property determination to account for payloads being moved by station robotic 
mechanisms. It also provides the ISS with non-propulsive attitude control by means of four Control Moment 
Gyroscopes (CMGs). When these two systems are operated together, navigation data exchange provides for 
enhanced fault detection and redundancy. Intersegment thruster firing requests provide for US CMG desaturation 
and increased control authority. Figure 2 shows the major GN&C data exchanges. Figure 3 shows the location of 
GN&C elements on the Stage 8A configuration, as it will be in April 2002. 
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Figure 2. ISS GN&C Data Exchange Interface. 
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Figure 3. ISS GN&C Element Locations. 


Since the introduction of Russia into the ISS partnership in 1993, GN&C system integration has been accomplished 
through technical interchange meetings, regular telecons, and a series of exhaustive integrated software tests. This 
process has included joint definition of requirements and interfaces, development of joint operating procedures and 
composition of integrated development, test, and verification plans. 


3 



The primary RS GN&C system was launched in July 2000 on the Zvezda Service Module. With the launch and 
activation of the US Laboratory in February 2001, the link between US and RS GN&C systems was established. In 
April 2002, the US GN&C navigation sensors will be launched, completing the baseline integrated ISS GN&C 
system. 

System performance to date has been excellent. GN&C hardware and software has performed as advertised with 
very few issues raised. The non-propulsive attitude control function has been nearly flawless, resulting in lower 
propellant usage than predicted pre-flight. Assessment of the benign nature of non-propulsive CMG attitude control 
has led to its support of mechanism deployments (solar arrays, radiators, etc.) usually relegated to free drift. 
However, the first year of operation was not without some surprises. 

Pointing Interruptions 

Within hours of US GN&C system activation, the engineering support team received its first surprise. The US 
command and telemetry interface is provided via a data link thru the US S-band antenna. This antenna provides a 
high degree of communication coverage with Mission Control-Houston every orbit by relaying data thru the NASA 
Tracking and Data Relay Satellites (TDRS). The US GN&C system pointing function uses a TDRS ephemeris to 
determine the target satellite location, and, since the US navigation function will not be activated until April 2002, 
Russian position and attitude data is used to define the ISS location and orientation. With this data, line-of-sight 
(LOS) pointing vectors are computed. Since the accuracy of the LOS vector is well under 1° and the antenna 
beamwidth is several degrees, the S-band antenna uses open loop pointing. 

Upon system activation, S-band communication was established without incident. However, a short time later, the 
antenna ceased tracking the satellite despite the continued How of pointing data and no apparent mechanical issues 
with the antenna drive mechanism. A subtle change in the RS GN&C data at the time of antenna stoppage pointed 
to the cause. The communication system software was designed, per requirement, to drive the antenna when 
receiving valid pointing data from GN&C, but not when receiving invalid data. However, GN&C data quality 
indicators are trinary rather than binary Hags. The pointing data may be labeled as valid, invalid, or degraded. The 
degraded state is used by the GN&C system as a relative accuracy qualifier to aid in best signal selection when 
multiple data sources are available. The US and RS flight control systems can operate nominally even when the 
pointing data is degraded. RS flight parameters specify several conditions for declaring Russian attitude data 
degraded. At this time, one such condition was satisfied. An attitude correction had not been performed within the 
last seven hours. Although the attitude data was still quite accurate, once the elapsed time had passed and this state 
transition had occurred, US antenna tracking ceased. Quick negotiations with Russian GN&C specialists resulted in 
a new time threshold of 100 hours being uplinked, and US communications were restored. Of course, the next US 
software release will modify the logic from, “If valid, then point,” to, “If not invalid, then point.” 

In a similar manner, the GN&C pointing function provides solar data to photovoltaic array and radiator orientation 
mechanisms. In addition to providing a solar LOS vector every second, the software also predicts sunrise and sunset 
events every 100 seconds. The US electrical power system was designed to use the solar data to optimize array 
pointing automatically, but for the two months prior to activation of the US GN&C system, US solar array 
orientation was managed by the use of position and rate setpoints. Once pointing data became available, the auto- 
tracking function was enabled. Operators then noticed that the solar arrays would briefly stop sun tracking twice per 
orbit. Data quickly revealed that this was occurring at sunrise and sunset, and the problem was traced to fault 
detection logic. The software monitored the GN&C data time information, and would reject data that was stale. 
After a solar terminator event, the high rate array pointing software would observe that the “next” solar terminator 
event identified by GN&C data was in the past, due to the slower update rate of this information. Therefore, the 
GN&C pointing data was deemed to be stale and not used, stopping the rotation of the solar arrays. This stoppage 
would persist until the next 100 second data update was made, at which time the arrays would catch up to the solar 
LOS. The effect on vehicle dynamics and power production has been negligible, and the next software release will 
amend the fault detection logic. 

Non-Propulsive Vents 

The ISS has a host of vents for dumping both gases and liquids. Some are regularly used vents, for such purposes as 
evacuating laboratory experiment chambers or releasing carbon dioxide scrubbed from the station air supply. 
Detailed analysis has been performed to verify that the dynamic disturbances caused by operation of such standard 
vents are compatible with the station’s microgravity mode of operation. Other vents are either used for specific 
transient or contingency operations, such as venting a Pressurized Mating Adapter (PMA) after departure of a 
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visiting vehicle, or for relief valves during overpressure conditions. In most cases, the dynamic effects of these 
vents received less scrutiny since they would not be used during microgravity operations. In addition, most have 
been fitted with a non-propulsive “T” vent so there would be no resultant force from their use. 

Four hours after the departure of the Orbiter that delivered the US GN&C system, the crew evacuated the 
atmosphere of the PMA on the nadir side of the US node module. This was common practice for humidity control 
in these elements once they are unpowered. This was the first time that this venting had been performed under US 
non-propulsive attitude control; previously, this had been performed under propulsive control provided by the 
thrusters of the Orbiter or RS GN&C system. In order to provide completely non-propulsive attitude control, the US 
GN&C system uses a very low bandwidth controller in a mode called momentum management. In this mode, 
vehicle attitude motions are established to allow the control system to balance the external environmental torques 
about an equilibrium point while maintaining the momentum state of the CMGs within a bounded region. 

At the time of PMA venting, the station was under non-propulsive attitude control. Since the station was not in a 
microgravity regime, and the PMA atmosphere was to be vented thru a non-propulsive T-vent, analysis of the 
resultant dynamics had not been performed a priori. The GN&C team was surprised to observe an attitude excursion 
of 10° over the course of nine minutes, and the momentum manager requesting thruster firings to desaturate the 
CMGs. The initial suspicion was that one side of the T-vent was blocked, but there was no credible hypothesis for 
how that could have happened. It was also noted that while one of the two sides of the vent pointed to deep space, 
the other pointed roughly towards the US port solar array, shown as the vector exiting the top of Figure 4. (This 
figure shows the Shuttle Orbiter below, but that vehicle had departed.) Although the array was nearly 100 feet from 
the vent, since the array was nearly broadside to the plume effluent, self impingement appeared likely. However, 
reconstruction of the disturbance did not yield a supporting disturbance function; an empirically reconstructed 
disturbance function suggested another cause. Detailed plume modeling was employed, verifying what the 
empirical data suggested. Plume impingement was indeed the cause, but not upon the solar array. The expanding 
effluent was actually grazing the skin of the Lab module on which the T-vent was mounted, producing a 
perpendicular propulsive force. 



Figure 4. US Lab Vacuum Relief Vent Orientation 


In addition to PMA evacuation, some additional vents that had not been assessed for their effect upon the non- 
propulsive attitude control system were Orbiter cabin and docking system vents, used to support crew extravehicular 
activities, Orbiter Flash Evaporator System vents used for thermal control, and Progress vehicle propellant resupply 
line vents, which are purged prior to departure of the vehicle. Such disturbances have since been characterized and 
the operators have the discretion to enable propulsive attitude control if the expected attitude disturbance might 
interfere with station subsystems or planned events. 
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Control without Command Capability 

The US Command and Control (C&C) computers provide the command and control interface between the ground 
and crew and all US subsystems, including GN&C. They also provide telemetry data for insight into subsystem 
status. On 25 April 2001, during the third visit of the Shuttle after US GN&C system activation, the three US C&C 
computers all went off-line. This event occurred while the US GN&C system was providing non-propulsive attitude 
control for the mated Shuttle/Station stack. 

The US GN&C system maintained attitude control in the blind for more than 32 hours, with its only active external 
interface being that to the RS GN&C computer, its source for navigation data. Therefore, the GN&C system could 
not be commanded, nor could its health or performance be observed directly. During this time, ISS GN&C 
engineers used Shuttle Inertial Measurement Unit data to gauge ISS control system performance. 

CMG/Thruster Force Fight 

A benign transition of the priority assignment of the three US C&C computers was scheduled for Memorial Day 
weekend 2001. Such a transition results in a communication interruption of about 20 seconds across the interface 
between the US and RS command computers. In order to verify that this transition would not impact the RS C&C 
computers, the procedure for the transition was validated by Russian system specialists in Moscow prior to the 
event. The US GN&C system was in its non-propulsive control mode at the time of transition. 

However, following procedure validation, a Russian specialist added one additional step to the procedure to further 
enhance RS safing. This additional step was executed three minutes prior to the reprioritization; at 10:42 GMT, 
Moscow Mission Control disconnected the interface between the US and RS C&C computers. At GMT 10:45, the 
C&C computer reprioritization was performed. Because the interface between the US and RS C&C computers was 
not re-enabled, two minutes after the US C&C computer reprioritization, RS fault detection software commanded 
the RS GN&C system to unconditionally take control of ISS with attitude control thrusters. This safing reaction was 
appropriate for a true US control system failure, but not for an intentional severing of the C&C interface. 

With no command interface to the US segment, the RS C&C computers could not request the US GN&C system to 
relinquish control. As the RS attitude control thrusters were fired to reduce the attitude motions that had been 
established by the US momentum management controller, the US GN&C control system applied its CMG torque to 
oppose this unexpected external disturbance. A force-fight ensued. Within a minute, the thrusters had reduced the 
ISS attitude errors within the RS GN&C system’s allowable deadbands. The CMGs continued the force fight, 
mostly unnoticed by the RS GN&C system since the propulsive system has an order of magnitude more control 
authority than the non-propulsive CMGs. Two minutes later, the CMGs saturated and the US GN&C system 
declared a loss of attitude control since it now had no control effectors, despite the fact that the attitude was being 
held perfectly by the RS GN&C system. Figure 5 shows the attitude errors and CMG torque during this time. 
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Figure 5. Attitude Error and CMG Control Torque during Force Fight. 


The crew reconnected the C&C computer interface 40 minutes later, and control was eventually transferred back to 
US GN&C. Since the US control system uses a low bandwidth, low torque controller, there were no adverse effects 
of this force fight, as existing safety studies had concluded. The cause was quickly traced to the insertion of the one 
additional procedure step which severed the US/RS C&C computer interface. Even with the inclusion of this step, 
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had bus fault detection been inhibited, the procedure would have been completed without incident. The important 
point was that adding one additional step invalidated the completed procedure validation testing. 

Lessons and the Future 

These first year surprises illustrate the complexity of GN&C integration on such a large scale program. During 
program planning, trades were made regarding the appropriate level of integrated subsystem testing. Because ISS 
activation is accomplished over several years, not on a single launch, the first opportunity to integrate many 
elements is on-orbit. Exhaustive formal testing is performed for each subsystem. For GN&C, detailed formal 
testing of the US and RS GN&C systems was performed both independently and together. This has resulted in 
predictable on-orbit performance with few exceptions. On the other hand, the amount of inter-subsystem testing had 
to be managed to trade cost versus risk. As these surprises show, some issues were not identified during testing. 
But they also show that those that were not detected were low risk. They have been accommodated by operational 
work-arounds until future software modifications can be made. 

Such a trade philosophy was also applied to analytical verification. The ISS GN&C team analyzed all nominal 
operations and single failure and contingency events that carried risk. Some events, such as contingency vents, 
vents on visiting vehicles (where data must be acquired from completely independent US and Russian spacecraft 
programs), or US solar array stoppages, were characterized only after the fact. They have since been studied and 
guidelines have been developed to address them in future operational planning. 

Operational procedures and approaches continue to be adjusted and improved as the International Partners learn to 
jointly operate this spacecraft. This includes daily planning of logistical resources, crew time, and shared assets, 
such as fuel or communications bandwidth. However, a lesson that space programs have learned repeatedly, and 
ISS is no exception, is that no amount of testing will suffice if procedures are circumvented. Whether by intention 
or human error, this may occur from time to time. The GN&C system has to be capable of safely isolating and 
recovering from these inadvertent events, as ISS has done so far. 

In the future, ISS GN&C system robustness will continue to increase. US GN&C sensors being launched in April 
2002 will enhance navigation system redundancy and capability. Additional software will expand fault detection 
and recovery capabilities as well as correct current deficiencies. The addition of the European ATV to the ISS 
program will provide another option for fuel resupply and propulsive control. And through continued operation of 
this integrated GN&C system, teams from around the world will continue to learn to work together in space. 
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